Avoid showing the password in phpinfo()'s output

ChangeLog

@@ -18,6 +18,7 @@ phpMyAdmin - ChangeLog
   view name in main panel db Structure page
 - bug #3439292 [core] Fail to synchronize column with name of keyword
 - bug #3425156 [interface] Add column after drop
+- [interface] Avoid showing the password in phpinfo()'s output
 
 3.4.7.1 (2011-11-10)
 - [security] Fixed possible local file inclusion in XML import

libraries/auth/cookie.auth.lib.php

@@ -549,6 +549,10 @@ function PMA_auth_set_user()
     $cfg['Server']['user']     = $GLOBALS['PHP_AUTH_USER'];
     $cfg['Server']['password'] = $GLOBALS['PHP_AUTH_PW'];
 
+    // Avoid showing the password in phpinfo()'s output
+    unset($GLOBALS['PHP_AUTH_PW']);
+    unset($_SERVER['PHP_AUTH_PW']);
+
     $_SESSION['last_access_time'] = time();
 
     // Name and password cookies need to be refreshed each time

libraries/auth/http.auth.lib.php

@@ -207,6 +207,10 @@ function PMA_auth_set_user()
     $cfg['Server']['user']     = $PHP_AUTH_USER;
     $cfg['Server']['password'] = $PHP_AUTH_PW;
 
+    // Avoid showing the password in phpinfo()'s output
+    unset($GLOBALS['PHP_AUTH_PW']);
+    unset($_SERVER['PHP_AUTH_PW']);
+
     return true;
 } // end of the 'PMA_auth_set_user()' function